PT-2025-46881 · D Link · Dir-882 Router

Published 2025-10-09 · Updated 2025-11-13 · CVE-2025-60697

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions D-Link DIR-882 Router firmware version DIR882A1 FW102B02

Description A command injection issue exists in the D-Link DIR-882 Router firmware. The sub 4438A4 function within the prog.cgi binary stores user-provided DDNS parameters, ServerAddress and Hostname, in NVRAM using nvram safe set. These values are subsequently retrieved by the start DDNS ipv4 function in the rc binary using nvram safe get and incorporated into DDNS shell commands executed via twsystem() without adequate sanitization. The partial string comparison implemented is insufficient to prevent command injection. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to the router’s web interface, potentially allowing arbitrary command execution on the device.

Recommendations Update to a newer version of the D-Link DIR-882 Router firmware that addresses this issue.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-14842

CVE-2025-60697

Affected Products

Dir-882 Router

References · 8

• 🔥 https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/CVE-2025-60697.md · Exploit
• https://dlink.com/en/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60697 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14842 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-60697 · Security Note
• https://github.com/yifan20020708/SGTaint-0-day/blob/main/DLink/DLink-DIR-882/4.md · Note
• https://t.me/CVEtracker/37273 · Telegram Post
• https://dlink.com · Note